I can get you my SASL config from my test environment when I get to the office. One thing to keep in mind, is that you MUST do an authenticated bind to AD, you cannot do anonymous bind, so you have to have a service account setup to allow SASL to authenticate to AD. It can be the most basic user account, just has to be able to log into AD.